High CPU usage from processes with file operations on a large number of files or directories in the /tmp (tmpfs) file system

Article Id:156748

Status:Published

Updated On:16-07-2012 13:07

Legacy Id:TECH192788

Products:

Critical System Protection

Issue/Introduction:

High CPU utilization can result from IPS monitoring tmpfs file systems (usually /tmp) when there are >10K files and directories present on the tmpfs file system. With very large numbers of files and directories, performance degradation should be expected in the /tmp file system.

Cause:

The Symantec Critical System Protection IPS driver requires the real or absolute path of the files and directories that are being checked against an IPS policy for access. The IPS driver makes a call to the Solaris readdir() function to get the real path at each level of the directory structure, where readdir() unexpectedly returns all of the entries under the entire tmpfs filesystem being traversed. Large numbers of files or directories worsen the performance impact of these calls and they can, in extreme conditions, consume most or all of the available CPU.

Commands that call chdir(), like find, rm, etc. on files under the /tmp filesystem will also trigger the issue.

Resolution:

Optimize the IPS driver code to get rid of the readdir() calls which were causing the large performance impact.